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Quantum communication, and indeed quantum information in general, has changed the way we 
think about quantum physics. In 1984 and 1991, the first protocol for quantum cryptography and 
the first application of quantum non-locality, respectively, attracted a diverse field of researchers in 
theoretical and experimental physics, mathematics and computer science. Since then we have seen 
a fundamental shift in how we understand information when it is encoded in quantum systems. We 
review the current state of research and future directions in this new field of science with special 
emphasis on quantum key distribution and quantum networks. 

PACS numbers: 03.65.Ud, 03.67.-a, 03.67.Dd, 03.67.Hk 



I. INTRODUCTION 

Quantum communication is the art of transferring a 
quantum state from one place to another. Traditionally, 
the sender is named Alice and the receiver Bob. The 
basic motivation is that quantum states code quantum 
information - called qubits in the case of 2-dimcnsional 
Hilbert spaces - and that quantum information allows one 
to perform tasks that could only be achieved far less effi- 
ciently, if at all, using classical information. The best 
known example is Quantum Key Distribution (QKD) 
[H> 13) Q • Actually, there is another motivation, at least 
equally important to most physicists, namely the close 
connection between quantum communication and quan- 
tum non- locality 0, EJ , as illustrated by the fascinating 
process of quantum teleportation [6[ . 

Quantum communication theory is a broad field, in- 
cluding e.g. communication complexity [3] and quan- 
tum bit-string commitment [8| . In this review we restrict 
ourselves to its most promising application, QKD, both 
point to point and in futuristic networks. 

There are several ways to realize quantum communica- 
tion. We list them below from the simplest to the more 
involved. Since "flying qubits" are naturally realized by 
photons, we often write "photon" for "quantum system" , 
although in principle, any other quantum system could 
do the job. 

• 1 photon: Alice encodes the state she wants to com- 
municate into a quantum system and sends it to 
Bob, sections Hn]& El 



• 2 photons: Exploit entanglement to prepare the 
desired quantum state at a distance, section ITT1 

• 3 photons: Teleport the quantum state from Alice 
to Bob, section fVl 

• 4 photons: Teleport entanglement, also called en- 
tanglement swapping, section PVTl fc IVIll 

We will review quantum communication not with this 
complexity in mind but from a more intuitive perspective, 
starting from the basic ingredient, namely entanglement 
and its non- locality, continuing in section IIIII with weak 



FIG. 1: Revealing non-locality. Alice and Bob independently 
perform experiments x and y, on an entangled state at space 
like separated locations, and study the correlations for the 
results a and b. 



laser pulse QKD and its security (section [TV}, before dis- 
cussing quantum teleportation in section |Vl We end by 
reviewing quantum relays and repeaters (section I Vip . the 
latter requiring quantum memories (section IVII[) . Along 
the way, we underline future challenges. 



II. ENTANGLEMENT & NON-LOCALITY 

Entanglement is the essence of quantum physics. 
To understand this statement already stressed by 
Schrodinger in 1935 ||, it is worth presenting it in mod- 
ern terms inspired by quantum information theory. In 
Science in general, all experimental evidence takes the 
form of conditional probabilities: if observer Ai performs 
the experiment labelled xi , she observes ai and in general 
one writes the probability for all of the possible results 
P(ai . . . a n \xi . . . x n ). Such conditional probabilities are 
often called correlations. For simplicity, we restrict the 
discussion here to the bi-partite case, denoting their cor- 
relation P(a, b\x, y). 

The correlations P(a, b\x,y) carry a lot of structure. 
Apart from being non-negative and normalized, the local 
marginals are independent of the experiment performed 
by independent observers: ^ a P(a, b\x, y) — P{b\y) is in- 
dependent of the experiment x performed by Alice. As 
a trivial example of independent observers, imagine two 
physicists performing different experiments in labs in dis- 
tant countries, in which case the independence of the 
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marginals is obvious. There is however another more 
interesting situation. Suppose the two parties perform 
similar experiments, but at two space-like separated lo- 
cations, thus preventing any communication, as is the 
case in Fig.[TJ It is therefore natural to assume that the 
local probabilities depend only on the local state of af- 
fairs and, as the local state of affairs may be unknown, 
one merely denotes them by a generic symbol A. Note 
that the local state of affairs at Alice's site and at Bob's 
site may still be correlated. This is why computer sci- 
entists call A shared randomness. Given the local state 
of affairs, the correlations factorize to local correlations, 
P(a,b\x,y, A) = P(a\x, A) • P(b\y, A), which necessarily 
satisfy some (infinite) set of inequalities, known as Bell 
Inequalities p, [Hj. Let us emphasize that there is no 
need to assume predetermined values to derive Bell In- 
equalities, it suffices to assume that the probabilities of 
results of local experiments depend only on local vari- 
ables. 

Almost all correlations between independent observers 
known in Science are local. The only exceptions are some 
correlations predicted by quantum physics when the two 
observers perform measurements on two (or more) entan- 
gled systems. This implies that in some cases, a quantum 
experiment performed at two distant locations can't be 
completely described by the local state of affairs [j|, a 
very surprising prediction of quantum physics indeed! 

Einstein, among others, was so surprised by this that 
he concluded that it " proves" the incompleteness of quan- 
tum mechanics [11] . Following Bohr's reply to the famous 
EPR paper, the debate became philosophical. John Bell 
resolved this with the introduction of the experimental 
question of Bell Inequalities [1, [l(| Upland remarkably, 
by 1991, it had become applied physics [3]. Indeed, it was 
realized that the non-existence of a local state of affairs 
guaranties that Alice and Bob's data have no duplicate 
anywhere else in the world, in particular not in any ad- 
versaries' hands. The intuition is clear: since there is no 
A, no one can hold a copy of A, hence no one can com- 
pute the probabilities for Alice and Bob's data, P(a\x, A) 
and P(b\y,X). Consequently, Alice and Bob's data have 
some secrecy. This is the essence of QKD, but clearly, 
this intuition needs elaboration (see section [TV)) . 

Let us conclude this section with a brief review of 
the experimental and theoretical status of quantum non- 
locality. Today, no serious physicist doubts that Na- 
ture exhibits quantum non-locality. Despite the depth 
of such a conclusion (whose revolutionary aspect is often 
not fully appreciated), it has turned out to be exceed- 
ingly difficult to realize an experiment between space-like 
separated parties with detection efficiencies high enough 
to avoid the detection loophole 13]. While the detec- 
tion loophole was closed in an ion trap experiment, the 
close proximity of the ions ensured that these were not 
space-like separated [13]. Only a couple of experiments 
have managed to perform space-like separated tests with 
entanglement fl5| distributed over ten kilometres both 
in fiber [ll| Il7l. Il8| and free space [lj| , though without 



closing the detection loophole. Also on the theory side, 
it is surprisingly poorly understood why the most well 
known Bell inequality, the CHSH-inequality, named after 
its discoverers [12|], seems the most efficient one despite 
the existence of infinitely many other Bell inequalities 
(however, see [Io|V In particular, we still have no practi- 
cal way to tell whether a given quantum state is able to 
exhibit non-locality or not. This limited understanding 
is especially frustrating once one realizes that the exper- 
imental violation of a Bell inequality is the only direct 
evidence for the presence of entanglement. Indeed, all 
the other entanglement witnesses require that one knows 
the dimension of the relevant Hilbert space [2(| . 



III. QUANTUM KEY DISTRIBUTION: FROM 
ENTANGLEMENT TO WEAK LASER PULSES 



One simple way to think about entanglement for the 
non specialist is that some composite systems, like pairs 
of photons, are able to provide the same random answer 
when asked the same question. Let us emphasize that 
the answer (measurement result) is random, but it is pre- 
cisely the same randomness that manifests itself at two 
distant locations, provided that Alice and Bob perform 
the same experiment (or experiments related by a sim- 
ple transformation). It then suffices that Alice and Bob 
independently choose to perform a series of experiments, 
drawn from a pre-established list of possible experiments, 
and, after recording all their data, they post-select those 
corresponding to the cases in which they happened, by 
chance, to have chosen to perform the same experiment. 
In these cases, they asked the same question and thus 
obtained the same random answer. This provides them 
with a cryptographic key. We'll analyze the secrecy of 
such keys in section IIV1 In this section we would like to 
concentrate on practical ways to implement QKD. 

The first choice that the quantum telecom engineer has 
to face is that of the wavelength. While most quantum 
optics experiments since the invention of the laser have 
used silicon-based detectors, limited to wavelengths be- 
low 1 /im, for long distance quantum communication one 
should also consider wavelengths suitable for fiber optic 
communication, 1.3 & 1.5/^m (although space commu- 
nication to satellites is a serious and fascinating alter- 
native [2l| that we can't review here). Nowadays, there 
are several options for detectors compatible with optical 
fibers, ranging from detectors based on superconduction 
transitions to commercially available APDs (Avalanche 
PhotoDiodes). 

The second choice concerns the degree of freedom in 
which to encode the qubits. An obvious first choice is 
the state of polarization, except that polarization is un- 
stable in standard fibers, especially in aerial fiber cables. 
In 1989 Jim Franson proposed the use of energy-time en- 
tanglement [22j, with the initial objective to test a Bell 
inequality, though later adapted to quantum communi- 
cation. Fig. [3 illustrates Franson's idea, consisting of a 
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FIG. 2: The Franson interferometer for testing the energy- 
time entanglement of the entanglement resource (ER). The 
correlations between each of Alice and Bob's results {0,1} 
depends on both the phase measurement settings {x,y}. 



CW laser that pumps a \ 2 nonlinear crystal, where each 
photon from the pump laser has a probability of, at best, 
10~ 6 to be down-converted into a pair of photons, de- 
pending on the crystal [23]. Each of the two photons 
has an uncertain energy (i.e. an uncertain wavelength), 
where uncertain should be understood in the quantum 
mechanical sense. However, through energy conserva- 
tion, the sum of the two photon's energy equals the well 
defined energy of the pump laser photon. Moreover, both 
photons are created at the same time (again through 
energy conservation), but this time is "quantum uncer- 
tain" within the long coherence-time of the pump laser. 
We see a nice analogy with the case presented by EPR: 
the energy and the age of each photon are uncertain, 
but the sum of the energies and the difference of their 
ages are both sharply defined. Look now at the two un- 
balanced interferometers and detectors on both sides of 
Fig. [2 which have replaced our abstract operations and 
measurements from Fig.[TJ and consider the cases where 
both photons hit a detector simultaneously. Recalling 
that the photons were produced simultaneously, this can 
happen in two ways: both photons propagate through the 
short arm of their interferometers; or both take the long 
arms. If the imbalance of both interferometers are alike 
and much smaller than the pump laser coherence length, 
then these two paths are indistinguishable. According 
to quantum physics, one should thus add the probabil- 
ity amplitudes and expect interference effects. These are 
2-photon interferences and have been used to violate the 
Bell CHSH-inequality [HIM 111- This configuration is 
thus suitable for QKD, but it is not practical using to- 
day's technology, hence let's simplify it (2f| . 

First, let's move the source from the center to the emit- 
ter, as in Fig. [3^,, thus limiting the number of sites to 
two. Now the photons don't arrive simultaneously at 
their detectors but, for an appropriate difference of ar- 
rival times, the same reasoning as above applies: one still 
has interferences between the short-short and the long- 
long 2-photon paths. The second simplification consists 
of moving the source to the left of Alice's interferometers, 
Fig. [3b. Now the two interfering paths are the short-long 
and long-short paths. As before, they are indistinguish- 
able and thus lead to interferences, though now one of 
the two photons is not really used (except possibly as 
a herald). This leads to the third and major simplifi- 
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FIG. 3: Simplifying the Franson scheme: a) The ER from 
Fig. [2] is moved to Alice's side; b) The ER is placed before 
Alice's interferometer - the interfering paths are different but 
we don't need the extra photon except as a herald; c) Remove 
ER and replace single heralded photon with attenuated pulsed 
diode laser. 



cation: replace this 2-photon source with a simple weak 
laser pulse, Fig.[3t. The story about the interfering paths 
remains the same, but the source is now very simple and 
reliable: a standard telecom laser-diode with enough at- 
tenuation. The 60 to 100 dB attenuation (requiring a 
well calibrated attenuator) assures that only a very small 
fraction of the laser pulses contain more than one pho- 
ton. It is essential to understand that, provided this frac- 
tion of multi-photon pulses is known, the security of such 
weak laser pulse QKD system is in no way compromised 
[MUll- Moreover, using the recent idea of decoy states, 
weak laser pulse QKD obeys the same scaling law as ideal 
single-photon QKD [10, Hll, H3] - 

Today, all practica l Q KD systems use this simplifica- 
tion El, [HlaElSlSHlSlaSlSlail^lSEi 

IHL l43| and the major challenge for QKD (besides the 
distance, to which we return in section IVI[) is the se- 
cret bit rate. Given that the source is not an issue, 
there remain two ways to improve this. First, we can 
make technical improvements, for example to the detec- 
tors whose maximal count rates are severely limited by 
dark counts and after-pulses (M , by using better In- 
GaAs APDs, up-conversion detection schemes p3l.l46l| or 
superconducting detectors [i?], . Second, the histori- 
cal protocols, like BB84 and Ekert91 0,0, were invented 
for the sake of presenting a beautifully simple idea, but 
today's many new protocols have been designed with the 
aim of optimizing their implementation using weak laser 
pulses [38l llll . lifjl IHol . IFll |H, HH or mesoscopic systems 
|54| . It is likely that more efficient protocols are yet to 
be discovered by teams combining telecom engineers and 
quantum physicists. 
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IV. SECURITY OF QKD 

The intuition as to why QKD provides perfectly secret 
bits is quite straightforward (section [n} . However, the 
details of the proofs are very involved and many questions 
remain open, especially concerning optimality [28], [55], 

Hf. 

We would, however, like to highlight just a few key 
concepts. We can characterize bounds on the security 
by comparing Shannon's mutual information [57j for Al- 
ice and Bob I {A : B) and for Alice and an adversary, 
traditionally called Eve, I (A : E). It is intuitive (and 
can be proven [58], ) that if Bob has more information 
than Eve on Alice's data, I (A : B) > I {A : E), then 
Alice and Bob can distill a secret key out of their data. 
This first intuition is, however, incomplete. Eve's infor- 
mation should, in full generality, be treated as quantum 
information: there is no way to know whether she per- 
formed measurements on her quantum systems (resulting 
in classical information) before the key is used. As our 
goal is to provide a secret key whose security does not rely 
on assumptions about Eve's technology, whether classical 
computer power or quantum technology, this remark has 
to be taken seriously. Fortunately, the quantum analog of 
Shannon's mutual information [601 ] and its consequences 
have recently been resolved [55| . 

A second limitation to the above intuitive idea is the 
so called man-in-the-middle attack: how can Alice and 
Bob be sure they really talk to each other? The answer is 
known and requires that they start from an initial short 
common secret, so as to be able to recognize each other. 
It has been shown that QKD provides much more secret 
key than it consumes. In this sense, QKD should be 
called Quantum key expansion. 

A third, less studied difficulty are side-channels: how 
can Alice be sure she doesn't inadvertently code more 
than one degree of freedom? For example, it might be 
that her phase modulator introduces a measurable distor- 
tion of the pulse envelope, in which case Eve could mea- 
sure the encoded bit indirectly and remain undetected. 
A related danger are Trojan horse attacks, in which Eve 
actively profits from the quantum channel (i.e. the op- 
tical fiber) to probe inside Alice and/or Bob's systems. 
Not too much is known to counter such attacks, except 
by emphasizing that real systems should be well charac- 
terized (see e.g. [6lT 162}). 

Before we end here, let us briefly elaborate on the 
widely used terminology unconditionally secure. Note 
that there is nothing like this: security proofs rely on 
assumptions and some assumptions are difficult to check 
in realistic systems. The historical reason for that ter- 
minology comes from classical cryptography where com- 
puter scientists use it to mean "not conditioned on as- 
sumptions about the adversary's classical computation 
power" , a meaning quite foreign to quantum physics. 




FIG. 4: Quantum teleportation. Alice performs a BSM, a 
joint measurement, on the unknown qubit \cj>) and one photon 
from the entangled state \EPR). The result does not reveal 
the state of the qubit but is sent to Bob who performs a 
result-dependent operation U to complete the teleportation. 

V. QUANTUM TELEPORTATION 

Quantum teleportation is the most fascinating mani- 
festation of quantum non- locality: an "object" dissolves 
here and reappears at a distance @! Well, not the en- 
tire object, "only" its quantum state, that is its ultimate 
structure, is transferred from here to there without ever 
existing at any intermediate location. The energy-matter 
must already be present at the receiver side and must be 
entangled with the transceiver. Quantum teleportation 
attracts a lot of attention from physicists and journal- 
ists, and rightly so. Mathematically, quantum teleporta- 
tion is very simple, but understanding requires clarifying 
some often confused concepts concerning quantum non- 
locality. 

The entire process requires 3 steps. Consider Fig.0] 
where one first has the distribution of entanglement, usu- 
ally photon pairs sent through optical fibers (for ions 
see [U Hil). The "quantum teleportation channel" is 
then established and - in principle - one could remove the 
fibers. Next, the sender performs a so-called Bell-State- 
Measurement (BSM) between his photon from the en- 
tangled pair and the qubit photon that carries the quan- 
tum state to be teleported [65], [66| . Technically, this is 
the most difficult step and usually only a partial BSM 
is realized (see however [ItHs!]). The BSM provides no 
information at all about the teleported state, but tells us 
something about the relationship between the two pho- 
tons [69l |. 

This ability to acquire information only about the re- 
lationship between two quantum systems is typical of 
quantum physics: it is another manifestation of entan- 
glement, but in this case not present between the incom- 
ing photons to be measured. The entanglement lies in 
the eigenvectors of the operator representing the BSM. 
Hence, entanglement plays a dual role in teleportation. 
Finally, the third step consists of Alice informing Bob 
of the result of her BSM and Bob performing a result- 



dependent unitary rotation on his system. Only after 
this operation is the teleportation process finished. Note 
that the size of the classical information sent by Alice to 
Bob is infinitely smaller than the information required 
to give a classical description of the teleported quantum 
state, but it is the need for this message that ensures that 
teleportation is a sub-luminal process. 

The BSM provides a fundamental limit to these exper- 
iments. It has been proven that no BSM with an effi- 
ciency greater than 50% is achievable with linear optics 
[7Cj |. To perform these partial BSMs, the two photons 
should arrive on a beam-splitter simultaneously within 
their coherence time. Since single-photon detectors have 
a large timing jitter, the timing has so far always been set 
by bulky and expensive femto-second lasers. Moreover, 
the length of the optical fibers should be stabilized within 
a coherence length of the photons, typically a few tens of 
microns, an unrealistic requirement over tens of kilome- 
tres. Consequently, some of the next steps will require 
detectors with improved jitter [H,[zH as well as compact 
sources of entangled photons with significantly increased 
single-photon coherence. Alternatively, this limitation 
has been overcome in some experiments by using contin- 
uous variables [72], [73| or hyperentanglement [74| > while 
others have used generalized quantum measurements to 
probabilistically distinguish 3 out of the 4 Bell states [75[ 
(it is an open question whether all 4 could be distin- 
guished using passive linear optics). The intense interest 
in BSMs is due to the key role it plays not only in tele- 
portation, but more importantly its role in long distance 
quantum communication and specifically entanglement 
swapping. 



VI. ENTANGLEMENT SWAPPING, RELAYS 
AND QUANTUM REPEATERS 

What happens if one photon from an entangled pair is 
teleported, i.e. if entanglement itself is teleported? This 
process, known as entanglement swapping, allows one to 
entangle photons that have no common past [7q ! The 
general idea consists of first establishing entanglement 
between not-too-distant nodes, then teleporting the en- 
tanglement from one node to the next. This is called a 
quantum relay [7?| and the general principle is illustrated 
in Fig. [5^,. So far only very few groups have demonstrated 
this process ([78|, [79|, H(J), but this is an active field of 
research as it has the potential to increase the distance 
for QKD. 

However, the distances achievable with quantum relays 
are still limited. The reason is that in order to be able 
to swap the entanglement of A-B and B-C to A-C, one 
first has to establish the entanglement between A-B and 
B-C. However, the probability that all photons propa- 
gate between A and B and between B and C is precisely 
the same probability that a photon propagates from A 
directly to C. Hence, there is no hope that entanglement 
swapping by itself helps to increase the bit rate. Still, 
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FIG. 5: Quantum networks, a) Quantum relay: ERs and 
quantum channels joined via a BSM. b) Quantum repeater: 
An ER + quantum memories (QM) provides a chaining ele- 
ment that can be concatenated for longer quantum commu- 
nication distances. Inset illustrates the difference between 
a "heralded QM" (i) and a possible modification for a QM 
without heralding (ii). 



quantum relays may be useful for some intermediate dis- 
tances, because in principle they allow one to mitigate the 
detrimental effects of detector dark-counts [z3, H3, [HJ • 

To efficiently overcome the distance limitation one 
needs quantum repeaters, which require both quantum 
relays and quantum memories [H, [84[. The basic idea 
is that if the entanglement distribution has succeeded 
between nodes A and B, but failed between B and C, 
one stores the A-B entanglement in quantum memories 
and restarts the B-C entanglement distribution. One can 
imagine concatenating entangled systems to further in- 
crease this distance (see Fig.[5t>)- Ideally, one would also 
like the quantum memories to contain a rudimentary (few 
qubit) quantum computer, able to realize the 2-qubit 
gates for purification or distillation techniques [85l l8q | to 
concentrate the entanglement contained in each of two 
pairs of qubits into a single highly entangled qubit pair. 
In practice, we are a long way from here but have started 
to think about interim possibilities. In a first instance, 
one may have a quantum memory where one doesn't 
know if it is loaded. In this case one could place the 
sources closer to one of the quantum memories in each 
chaining element of figure[5j3. The motivation behind the 
asymmetric sources is that if one has one photon directly 
absorbed by the quantum memory one can be more sure 
that it is loaded than if it had been transmitted, and 
possible absorbed/lost in the fiber. This thinking is rem- 
iniscent of the simplifications that we made with respect 
to Fig. [5] and the evolution from Franson's intereferome- 
ter to weak pulse encoded QKD. 

The development of a fully operational quantum re- 
peater and a realistic quantum network architecture are 
grand challenges for quantum communication. Despite 
some claims, nothing like this has been demonstrated so 
far and one should not expect any real-world demonstra- 
tion for another 5-10 years. 
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VII. QUANTUM MEMORIES 

If one is to successfully build quantum repeaters then 
one will need a quantum memory that is able to store 
a qubit for a period sufficient to allow several rounds of 
communication between the nearby nodes, i.e. typically 
several ms. In Fig. [5}) we denote the quantum memory by 
some absorbing medium, but more importantly, also with 
a heralding mechanism so we know when it is loaded. 
Furthermore, it should either be possible to perform a 
Bell state measurement between two stored qubits, or be 
able to trigger the release of photons carrying the qubits 
with a jitter small enough to achieve this, and all of this 
at wavelengths and bandwidths compatible with existing 
fiber optic networks. Today, the best quantum memory 
by far is a simple fiber loop (though it does not have 
all the above mentioned specifications). Storing qubits 
in some atoms, either in traps or in some solid-state de- 
vices, is a huge challenge. But the potential applications 
both for fundamental experiments (e.g. long-distance 
loophole-free Bell tests) and for a world-wide quantum- 
web motivates many physicists. Moreover, it is likely 
that the successful techniques will also find applications 
in other types of quantum information processors. 

Currently there is an increasing number of groups 
working towards quantum memories from a range of dif- 
ferent perspectives. The different approaches have so 
far been motivated by the degree of freedom chosen 
to encode the quantum state. We have already seen 
some progress: for continuous variable systems in atomic 
vapour (83| : atomic ensembles [H, [H, |9(3] ; polarization 
of atom-photon systems [9l|; others are using NV cen- 



ters in diamonds 92 | ; as well as rare-earth ions in fibers 
and crystals [H, [94 1. Indeed this last case is interest- 
ing, as most proposals have focused on storing a single 
mode, or single quantum state, whereas the rare-earth 
systems offer the possibility of storing multiple modes, 
many quantum states, which could have significant prac- 
tical implications. These and many more approaches are 
currently being actively pursued within national and in- 
ternational collaborative programmes around the world 

SE IE Sill. 



VIII. CONCLUSION 

The field of quantum communication has established 
itself over recent years thanks to its driving force, Quan- 
tum Key Distribution and to the fascinating process of 
quantum teleportation, not to mention continuous vari- 
able [99j and satellite quantum com muni cation [2l| and 
linear optics quantum computation [100]. It will be an 
important part of physics in the decades to come, with 
great challenges in quantum memories and repeaters for 
world-wide applications. It is an ideal teaching tool and 
is attracting bright young physicists who are learning to 
build the bridge between quantum physics and commu- 
nication technologies. 
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